Hardened Rust on CentOS Stream 9

Charges for this image cover the security hardening, optimization, and pre-integration work Hanwei performs on top of the upstream Rust and CentOS Stream 9 projects. The toolchain is installed during the image build and is on PATH at first boot, while the operating system underneath it is configured to a fixed hardened and tuned baseline and validated on EC2 before publication. A subscriber launches the instance and can compile immediately, with no toolchain installation, no hardening and no kernel tuning work to perform.

What Hanwei Adds to Upstream Rust

• Toolchain installed at build time: rustc and cargo are installed system-wide and present on PATH, removing the download-and-install step that would otherwise run after every launch. The current version ships rustc 1.79.
• Ecosystem tooling and build dependencies preinstalled: clippy and rustfmt are available alongside rustc and cargo, and gcc, pkgconf and the OpenSSL development headers are present so that crates requiring native linkage compile without further setup.
• Applied hardening beyond the distribution default: SSH is limited to modern ciphers, key exchange and MAC algorithms with a reduced authentication attempt limit; auditd is enabled with a base rule set; kernel network parameters reject source-routed and redirected packets and enable SYN cookies; and kernel pointer and dmesg exposure are restricted.
• Tuning baseline applied identically across the catalogue: the per-process file descriptor limit is raised from the distribution default of 1024 to 65536 and the memory-map ceiling from 65530 to 262144; the device receive backlog and the TCP SYN backlog are enlarged so that traffic bursts queue instead of being dropped; socket buffer maxima are raised so the kernel can autotune to larger windows on long-latency paths; TCP connections retain their congestion window across idle periods; and the journal is capped so logs cannot fill the root volume. The profile raises ceilings only and does not alter protocol semantics or application behaviour.
• AWS operational integration: the SSM Agent is installed and enabled, so instances can be reached through Session Manager without an inbound SSH rule and patched through Patch Manager; chrony is pointed at the Amazon Time Sync Service; and the root filesystem extends automatically at boot when the volume is larger than the image default.
• Patch level set at the build date: every package comes from official upstream repositories at the newest patch level published when the image was built, rather than from an older snapshot.
• Repeatable build and EC2 validation: each version is produced by the same build process and is launched and exercised on EC2 before release, so a given version always yields the same system state.

Access and Security Posture

• SELinux runs in enforcing mode and auditd records activity against a base rule set.
• Sign in as 'ec2-user' with the key pair selected at launch, then use 'sudo su -' for a root shell. Session Manager is available as an alternative that needs no inbound port.
• Direct root login over SSH is disabled, password authentication is not accepted, and authentication attempts are capped.
• No authorized keys, default passwords or other credentials are embedded in the image.

Operational Impact on EC2

• Launch-to-first-build time is reduced to a single boot cycle.
• Every instance starts from an identical, documented configuration, removing drift between development, CI and production hosts.
• Network services do not need per-host limit and backlog adjustments before they can handle load.
• Post-launch patching effort is lower because the package set is current as of the release date.

Where This Image Fits

• Build and CI hosts that compile Rust services and binaries.
• Development instances for teams working on Rust codebases.
• Cross-compilation, release-artifact and container build hosts.
• Short-lived instances for benchmarking or dependency auditing.

About Rust and CentOS Stream 9

Rust is a systems programming language that provides memory safety without a garbage collector. Its ownership and borrowing rules are checked at compile time, which removes data races and use-after-free defects from safe code, and its binaries run with no runtime or virtual machine. Cargo, the bundled build tool and package manager, resolves dependencies from the crates.io registry and drives compilation, testing and release builds. It is commonly used for network services, command line tooling and the performance-sensitive parts of larger systems.

CentOS Stream 9 is a Linux distribution that tracks the development stream of Red Hat Enterprise Linux 9. Packages land in CentOS Stream before they appear in a RHEL minor release, so it stays close to the RHEL package set and toolchain while remaining freely redistributable. It uses dnf, systemd and SELinux, which makes it a predictable base for server workloads that need RHEL compatibility.